I think Bob is spot on (though his response is beyond my technical skill-set).

I will add that the standard Salesforce Web to Lead is designed to be very 'dumb', in the sense that it never rejects any leads. It will take practically any incoming lead submission unless it breaks your validation rules, in which case you'll get an email from Salesforce. So almost all errors will be on the javascript / browser side.

You might want to look at the myriad of form submission add-ons. There's free plugins for [Wordpress][1] as well as most other CMS's, plus paid form submission tools (like FormAssembly) and paid landing pages (like Unbounce) that will accomplish the validation and other checks. These also hide your OID, which is handy as once spammers know that they can bypass your validation and submit to Salesforce directly.