In your robots.txt file, assuming this folder is at the root, include the following:
User-agent: *
Disallow: /donotindex/
...
The ellipsis on line 3 simply stands in for any other Disallow or Allow directives for all bots. If none exist, omit it.
This will prevent all mainstream bots from crawling the folder or indexing what's in it. This might not prevent your content from ending up in the index, though; for example, if that picture's URL is copied and linked to by another page, it might still get discovered. Plus, not all bots are polite enough to obey robots.txt directions.
In WordPress, there are a few things you can do to prevent your images being linked to. This article describes the various techniques, mostly using the WPShield Content Protector plugin, which can help you do the following:
- Disable Right Click and Dragging Images
- Hide Image URLs
- Disable Image Hotlinking
If you want your folder inside your web hosting panel to be accessible on the backend only to you (the admin) and not to anyone else who might be working on your website, check with your web host on how to restrict that folder access.