If you want only form validation your best bet would be to use ngx_lua or OpenResty, they can provide middle layer between http-server Front-End (nginx) and Back-End (PHP). Other technologies like CGI (WSAPI and other), uWSGI (WSAPI and other), FCGI (WSAPI and other), reverse HTTP-proxy (Xavante and other) - they are Back-Ends, I don't know is it possible to create middle layer using them, perhaps it is possible by extending Xavante. I think it is hard to write web-application in two languages PHP + Lua, I would recommend to optimize PHP code or swap to Lua completely and support our community :)
For spam protection I only know Akismet system by Automattic, it is free for personal websites and paid for commerical websites.
