X-Content-Type-Options limits or restricts the type of data read before loading it. This means if you have an input for user profile picture, you can restrict it to only .jpg or .png as the appropriate file format and no other options, or to accept various files except scripts, which can modify your code to reduce threats.